DIA-2 - Data Collection Point Inventory
Control for identifying and managing all points where data is collected
Control Definition
All points where the organization collects data from users, customers, employees and third parties must be identified and documented, recording for each one what data is obtained, its purpose, legal basis and its flow to the systems and third parties involved. The data flow map must be kept up to date whenever anything changes, and this inventory must be used as the basis for verifying compliance with privacy regulations and managing data subjects' consent.
Requirements
Requirement 1
We identify and document all points where the organization collects data from users, customers, employees and third parties.
Requirement 2
We record collection points in the inventory: web forms, APIs, mobile apps, third-party integrations, cookies, trackers and IoT sensors.
Requirement 3
For each collection point we document: what data is obtained, the legal basis for processing, the purpose, the flow to storage systems and third parties with access.
Requirement 4
We use the collection point inventory as the basis for complying with privacy regulations.
Requirement 5
We manage data subjects' consent based on the collection point inventory.
Requirement 6
We keep the data flow map (Data Flow Diagram) updated when applications change.